Polymarket Sports Live

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: polymarket-sports-live Version: 2.0.5 The skill is a legitimate sports arbitrage bot designed to trade on Polymarket based on real-time ESPN scores. It uses the 'simmer-sdk' to interact with markets and 'requests' to fetch live data from official ESPN API endpoints (site.api.espn.com). The code implements standard statistical models (Gaussian and Poisson) and includes safety features such as slippage checks and market context validation. No evidence of data exfiltration, credential theft, or malicious execution was found in sports_live.py or the accompanying documentation.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI02: Tool Misuse and Exploitation

What this means

If live mode is enabled, the skill could place repeated real-money market trades based on its model without asking you before each order.

Why it was flagged

The skill explicitly supports scheduled automatic execution and real trade placement in live mode. Financial trades are high-impact, and the provided artifacts do not show per-trade approval or an overall exposure/loss cap.

Skill content

Runs every 2 minutes via cron (`*/2 * * * *`). Managed automaton (auto-executes on schedule)... If `--live`: calls `SimmerClient.trade()`

Recommendation

Use dry-run or simulated venue first, set a very small trade size, and only enable live mode if you are comfortable with unattended trading risk.

Note

ASI03: Identity and Privilege Abuse

What this means

Your API key may allow the skill to access trading functions, especially if configured for the real Polymarket venue.

Why it was flagged

The code uses a Simmer API key and venue selection to access the trading service. This is expected for the stated purpose, but it gives the skill delegated account authority.

Skill content

SimmerClient(
            api_key=os.environ["SIMMER_API_KEY"],
            venue=os.environ.get("TRADING_VENUE", "sim")
        )

Recommendation

Use a scoped or limited API key if available, keep the default simulated venue until tested, and revoke the key if you stop using the skill.

Note

ASI10: Rogue Agents

What this means

Once installed as an automaton, it may keep running every two minutes until disabled.

Why it was flagged

The skill is designed to persist as a managed scheduled automaton. This is disclosed and aligned with live-score monitoring, but users should recognize it runs repeatedly in the background.

Skill content

"cron": "*/2 * * * *",
  "automaton": {
    "managed": true,
    "entrypoint": "sports_live.py"
  }

Recommendation

Confirm how to pause or remove the automaton before enabling it, and monitor logs/trading activity after installation.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Future or environment-specific package versions could affect how the skill behaves.

Why it was flagged

The skill depends on external Python packages without pinned versions in the provided artifact. This is normal for many integrations but leaves dependency behavior dependent on what gets installed.

Skill content

"pip": [
      "simmer-sdk",
      "requests"
    ]

Recommendation

Install in an isolated environment and pin/review dependency versions before using live trading.